The compliance checklist for launching cross-border card programs in Q1 2026
If you’re planning to launch a cross-border card program in Europe in Q1 2026, you’re stepping into a high-stakes environment. The fintechs that move early and execute well will grab the most valuable corridors and customers. The ones that treat compliance as an afterthought will spend 2026 firefighting – with regulators, schemes, and their own partners.
The reality is simple: regulation, infrastructure, and card schemes are all shifting at the same time. Q1 2026 is a strategic inflection point, and this checklist is about helping you get to that date with your program ready to scale, not just ready to go live.
Why Q1 2026 is a critical launch window for cross-border card programs
The demand side is already there. In the euro area, the total number of non-cash payments reached 77.6 billion in the second half of 2024 – up 8.6% year-on-year – with a total value of €116.9 trillion. Card payments accounted for 57% of all non-cash transactions, and there were 750 million payment cards in circulation, roughly 2.1 cards per person.
Those aren’t “early signals.” That’s an entrenched card culture across Europe – and it’s still growing. Add to this the structural shift in cross-border flows: the European Central Bank cites projections that global cross-border payment flows could double to around €268 trillion by 2030.
At the same time, the competitive landscape is being rewired. McKinsey & Company estimates that in 2024, up to 65% of the value of international peer-to-peer transfers was already captured by nontraditional providers – fintechs and alternative players, not banks. For card-focused fintechs, that’s both validation and a warning: the opportunity is huge, but the bar is high.
Q1 2026 sits right in the middle of several converging timelines. Regulatory packages like PSD3 and the Payment Services Regulation (PSR) are moving toward implementation. Cross-border payments are under active G20 and ECB scrutiny. Schemes are still adjusting fees, rules, and risk expectations after years of rapid growth. If you launch into this window with a solid compliance and infrastructure foundation, you’re positioned to ride those shifts. If you wait, you risk entering later into a more crowded, more regulated market—on other people’s terms.
The regulatory pillars you can’t afford to wing
When your card program crosses borders, regulation stops being a checkbox and becomes part of your product design. Your entity structure, authorizations, passporting model, and internal policies either support multi-market growth—or quietly block it.
Licensing, authorization, and passporting
Start with the most basic question: who is actually issuing and acquiring, and under which licenses?
If you’re active across several EU or EEA markets, you need a clear view of:
- Which entity holds the e-money or payment institution license
- Where that entity is passported
- Which activities (issuing, acquiring, distributing, BIN sponsorship, program management) are performed in each jurisdiction
- Where local notifications or specific regulator engagement are required
Legal and regulatory guides consistently highlight the same pattern: fast-growing fintechs underestimate cross-border authorization requirements and discover gaps only when a regulator or scheme asks uncomfortable questions. Your checklist here is straightforward but non-negotiable: match every jurisdiction you operate in to a license, a passport, and a documented regulatory obligation. If there’s a country on your go-live map that isn’t cleanly covered, fix that before you ship cards.
The cross-border payments rulebook
Cards are just one layer in a broader cross-border payments ecosystem. Regulation (EU) 2021/1230 on cross-border payments – and subsequent amendments – pushes toward transparent charges, equal pricing, and closer coordination between national authorities inside the Union.
For a cross-border card program, that matters because a single transaction can span multiple jurisdictions: issuing country → cardholder location → merchant country → acquirer location → settlement currency and country.
If you don’t map those flows explicitly, you can’t know which regulatory regimes apply, which disclosures are required, or where fee caps or transparency rules might bite. A robust compliance checklist should include a diagram of your flows for each core corridor and a clear statement of which rules apply at each leg.
Interchange, schemes, and the real cost of cross-border
Interchange and scheme fees are where a lot of “we’ll figure it out later” thinking comes back to haunt cross-border issuers.
Within the EU, the Interchange Fee Regulation (IFR) caps interchange at 0.2% for consumer debit and 0.3% for consumer credit in covered transactions. Those caps, however, were designed primarily for domestic scenarios, and cross-border or out-of-scope transactions can sit in a more expensive regime.
On top of that, studies show that while interchange was capped, other components of the merchant service charge—especially scheme fees—climbed significantly in the years after IFR took effect, in some cases almost doubling between 2018 and 2022.
If you’re building a cross-border program, “interchange + scheme fees + FX + MDR” is not a back-office detail—it’s a strategic input:
- Model different cross-border scenarios (EEA-to-EEA, EEA-to-UK, EEA-to-rest-of-world).
- Stress-test what happens as your cross-border ratio rises.
- Tie your cardholder pricing and disclosures directly to those cost structures.
Regulators will care about transparency. Schemes will care about your risk and volume profile. Your economics will depend on how well you anticipate the interaction of all three.
Infrastructure and scheme readiness: Your operational backbone
You don’t run a cross-border card program on PowerPoints, you run it on payment rails. That means understanding exactly how money and data move when your card is used thousands of miles away from the issuing entity.
Payment system access and settlement chains
Every cross-border card transaction taps into a chain: issuer → scheme → acquirer → settlement and FX providers → merchants. The Bank for International Settlements and CPMI have repeatedly flagged limited or indirect access to payment systems and complex settlement chains as key friction points in cross-border flows.
From a compliance and risk standpoint, you should be able to answer:
- Where and how does settlement occur for your core corridors?
- Which currencies do you settle in, and who is taking FX risk?
- Where do funds “sit” at each point in the chain, and under which regulatory regime?
- How do you manage liquidity and cut-off times across time zones?
A solid checklist item here is a documented settlement architecture per corridor, including currency exposures and liquidity requirements — and confirmation that each acquirer/processor you rely on is both technically capable and regulatory-compliant for the flows you expect.
Scheme strategy: Global, regional, or local?
Your choice of scheme is a strategic decision, not just a logo on the card. In the euro area, international card schemes account for about 61% of card payments, with national schemes making up the remaining 39%. For transactions where euro-area cardholders pay non-euro-area merchants, the share of national schemes drops further to around 37%, because national schemes typically don’t process out-of-country transactions.
In other words, cross-border acceptance is dominated by international schemes. That doesn’t mean local or regional schemes don’t matter. They can bring cost advantages, data-locality benefits, or strategic alignment with regulators. But you need to explicitly weigh:
- Reach vs. cost
- Data access and analytics vs. regulatory expectations on data residency
- Scheme rules around cross-border, SCA, and chargebacks
- Long-term roadmap: tokenization, real-time payments integration, digital wallets
A good way to frame this in your checklist: for each scheme you plan to use, document how it supports your cross-border strategy, where it might constrain you, and what your “plan B” is if fees or rules change.
Operational readiness: Fraud, SCA, AML, and FX risk
As you go cross-border, your risk profile changes. Fraudsters target cross-border flows precisely because they’re harder to monitor and dispute. Strong customer authentication (SCA) rules continue to evolve under current and upcoming EU payments legislation. Meanwhile, contactless card payments in the euro area grew by 15.5% year-on-year to 29.5 billion transactions in the second half of 2024, reaching €0.8 trillion in value. That scale brings convenience—and a larger attack surface.
On the compliance side, you’re layering:
- Cross-jurisdiction KYC and onboarding policies
- AML monitoring tuned for multiple currencies and behaviors
- SCA flows that must work consistently across markets and channels
- FX risk management tied to card settlement and funding cycles
Your internal checklist should include regular stress tests for fraud and chargeback spikes, corridor-specific rule tuning, and a clear playbook for updating SCA and risk logic when regulations or scheme rules change.
The unsexy, high-impact items: Data, disclosure, and resilience
A lot of programs get the “big” topics roughly right – license, BIN, scheme – and then get tripped up by the operational basics regulators care about most.
Data protection and cross-border transfers
If your program touches EU or EEA residents, you’re operating under GDPR plus any local data protection nuances. Cross-border card programs often involve:
- Storing or processing data in multiple jurisdictions
- Routing transaction data through global scheme infrastructure
- Using third-party processors for fraud, analytics, or KYC
Your compliance checklist should explicitly cover:
- Data-flow mapping (which data goes where, under what legal basis)
- Use of Standard Contractual Clauses or other transfer mechanisms where required
- Alignment of all key vendors and partners with your data protection obligations
If you can’t show a regulator your data-flow map and transfer rationale, you’re taking unnecessary risk.
Consumer rights, disclosures, and fee transparency
Cross-border card programs live and die by trust. Cardholders should never be surprised by:
- FX markups or conversion methods;
- Cross-border or out-of-network fees;
- Limits, holds, or reserve practices;
- Dispute timelines and liability allocation.
From a compliance perspective, your cardholder agreement and disclosures need to align with both issuing-market and local consumer-protection rules where the card is used. From a business perspective, clear pricing and honest explanations of FX and fees are crucial to avoid reputation-damaging complaints and social media heat.
Business continuity, operational risk, and partner due diligence
Every party in your value chain – issuer, BIN sponsor, scheme, processor, acquirer, core banking provider, FX desk – is a potential point of failure. Cross-border programs magnify that exposure.
Your checklist should include:
- Formal partner risk assessments, including geography and regulatory regimes
- Documented SLAs tied to uptime, dispute handling, and remediation
- Business continuity plans that assume one or more key partners are offline
- Regular resilience exercises that test your ability to reroute, pause, or scale back flows without losing control of compliance or customer experience
How Satchel helps fintechs launch compliant cross-border card programs
All of this can sound daunting if you’re trying to build everything yourself. That’s exactly the gap Satchel is designed to fill.
Satchel operates as a European electronic money institution licensed by the Bank of Lithuania and is a principal member of Mastercard Europe for card issuing. In practice, that means you can plug into an existing regulatory and scheme framework instead of spending years and millions obtaining licenses and scheme memberships on your own.
The Satchel White Label Card program is built specifically for fintechs and financial institutions that need to go multi-market fast, without cutting corners on compliance. The model gives you:
- A fully operational card-issuing stack powered by a European Mastercard licensee, so you can issue physical and virtual cards, including contactless and tokenized cards, across EEA market.
- Built-in card tokenization, 3-D Secure, and anti-fraud/risk management, helping you meet SCA and security expectations out of the box.
- No collateral requirements, no hard limits on your first order, and flexible tariffs, which lets you scale volumes without being blindsided by punitive upfront terms.
- A fast launch timeline: a fully operational card project can go live in as little as 15 business days, covering card design, production, integration, and rollout.
- API-driven integration with the Satchel broader payment infrastructure, including multi-currency accounts and SEPA rails, giving you end-to-end coverage for cross-border payment flows.
Because Satchel is already regulated, already connected to schemes, and already running multi-currency flows across Europe, much of the heavy lifting in your checklist – licensing, scheme access, settlement setup, SCA, and fraud tooling – is handled at the platform level. You still need to own your local compliance, customer disclosures, and risk appetite, but you’re not reinventing the infrastructure or regulatory wheel.
If your strategy is to launch or expand a cross-border card program in Q1 2026, partnering with a provider like Satchel lets you focus on product, customer experience, and growth—while leaning on a stack that was designed from day one for regulated, pan-European operations.
Action plan: What you should be doing now to be ready for Q1 2026
With Q1 2026 on the horizon, “we’ll get to it later” is no longer an option. A practical action sequence looks like this:
- First, run a full end-to-end compliance gap assessment. List every country where you plan to issue cards or support spending. For each, verify licensing/authorization coverage, passporting status, local regulatory expectations, scheme support, settlement flows, and consumer-protection requirements. Translate that into a roadmap with clear milestones: license and passport coverage confirmed; scheme strategy locked; settlement architecture documented; pricing and fee disclosures signed off by legal; data and AML policies updated for multi-market use.
- Next, engage regulators and commercial partners. If you need to notify or consult with host regulators, start those conversations now—not the month before launch. Lock in your scheme and processor relationships, and verify they can support your projected volumes and corridors, including FX and settlement requirements. Internally, update your onboarding, fraud, AML, and data-handling policies to match the reality of cross-border operations, not just domestic ones.
- Finally, build for change, not for a frozen rulebook. Frameworks like PSD3 and PSR, IFR reviews, and the G20 roadmap on cross-border payments are all moving pieces. Timelines may slip, but directionally the expectations are clear: faster, cheaper, more transparent cross-border payments with stronger consumer protections. Your architecture should be modular and configurable enough that when rules change – on SCA, data, fees, or access – you can adapt without tearing your stack apart.
The bottom line
Launching a cross-border card program in Europe in Q1 2026 isn’t about getting cards in people’s hands. It’s about proving that you can operate at the intersection of growth, regulation, and infrastructure without losing control of your economics or your risk.
The data is clear: cards dominate non-cash payments in the euro area, cross-border flows are set to expand dramatically, and nontraditional players are already capturing a large share of international P2P value. The compliance and scheme landscape, meanwhile, is becoming increasingly more demanding.
If you treat this checklist as a formality, you’ll feel it later in regulatory friction, surprise costs, and partner pushback. If you treat it as your launchpad, backed by the right infrastructure partner, you give your cross-border card program a real chance to be what it should be: a durable, scalable growth engine.
Start now, build with intent, and when Q1 2026 arrives, you won’t just be live—you’ll be ready.
